Posts on Schwitzd

Moved to Libvirt

Sun, 23 Aug 2026 12:37:38 +0000

During the hot Ferragosto weekend, I decided to take a break and try out Libvirt. It had been on my to-do list for a long time, but I never had the motivation (or maybe just laziness?) to try it as a replacement for VirtualBox.

The stack I’m going to use will be, KVM (Kernel-based Virtual Machine) built directly into the Linux kernel to handle CPU and memory virtualization, while QEMU emulates the remaining hardware components like storage and graphics. Libvirt acts as the management layer bridging everything together, allowing me to control my VMs through both a graphical interface (virt-manager) and the command line (virsh).

My Openvino Notes

Sun, 07 Dec 2025 07:52:41 +0000

These are my notes explaining on how to run models on an Arch Linux machine using the OpenVINO model server inside a Docker container. My Medion notebook is equipped with both an Intel NPU and an Intel ARC GPU. I tried running models on both.

Requirements

Install required driver packages:
- GPU: intel-compute-runtime
- NPU: intel-npu-driver
Add the user to groups render and video:
```
sudo usermod -aG render,video "$USER"
```
To check that everything has been installed on the local machine, run the following code snippet inside a Python virtual environment with the openvino package installed.

Argocd: from Opentofu to Applicationset

Sun, 09 Nov 2025 15:46:09 +0000

Since starting to work on my Home Cluster, I have already tried three different deployment strategies for managing workloads. To provide context for the new approach, it is helpful to review how the workflow has evolved.

Initially, I used OpenTofu, deploying everything with the helm_release resource from the Helm provider. This was straightforward and fully controlled from the IaC repository.

Later, I introduced Argo CD, adopting a hybrid strategy. OpenTofu continued to deploy workloads using the helm_release resource until Argo CD was fully operational; then it created Argo CD applications using the argocd_application resource. While this approach was effective, it resulted in duplication and unnecessary coupling between OpenTofu and Argo CD.

How I Automated Garage Deployment

Sun, 26 Oct 2025 08:40:48 +0000

After MinIO’s decision to remove all the features from the community edition, I switched to Garage. After the initial deployment test, I quickly realized that many manual steps were required before it could be used. For example, you must create a layout for storing the buckets and then create the buckets themselves.

As usual I decided to come up with my overcomplicated solution:

Use a Kubernetes job to bootstrap the layout.
Create an Admin Garage API token with a K3s job.
Use my Terraform Garage provider to deploy buckets.

The idea behind my home cluster is that everything should be automated as code and deployed with Argo CD. As I mentioned, I created a bootstrap process to prepare Garage to create buckets.

Secure DNS Networkd Resolved

Sat, 23 Aug 2025 11:42:42 +0000

This article will be very similar to Integrate Dnscrypt-proxy with a Home DNS Server, with the main difference that instead of using Dnscrypt-proxy to forward DNS queries to your preferred DoH nameserver, I will use systemd-resolved. At the moment, systemd-resolved only supports DoT (DNS over TLS). Support for DoH is still under development (issue #8639).

Configure systemd-resolved

Make sure it’s running and that /etc/resolv.conf points to it.

sudo systemctl enable --now systemd-resolved

Symlink /etc/resolv.conf to the stub resolver:

Arch Post Install

Sat, 23 Aug 2025 07:18:14 +0000

I decided to buy a new laptop so is become the time perform a new installation of Arch, in the past I already installed it from scratch, trying to fine tune every single settings, was really funny but this time I will opt for a more chilly approach and I will use Archinstall.

Because I would like to use different technologies I will test my installation first in VirtualBox leveraging the installation over SSH as I explained on a past article Install Arch with SSH

Mikrotik - Tunnelbroker with Route64

Mon, 18 Aug 2025 19:29:54 +0000

For learning purposes, I started looking into IPv6. First, I enabled a Unique local address subnet to leverage K3s dual-stack on my Home Cluster. Then I thought it would be cool to be able to connect to my home from abroad, so I started investigating VPNs. It is at this point that I discovered that my ISP currently is only offering IPv4 behind CGNAT for mobile devices (My Mikrotik connects to internet over LTE. Surfing the web I learned about tunnel broker is a service that provides IPv6 connectivity over an existing IPv4-only internet connection by encapsulating IPv6 traffic inside IPv4 packets.

Troubleshooting Longhorn Slow Startup

Sun, 13 Jul 2025 11:29:42 +0000

In my K3s home cluster, I use Longhorn as the storage engine for my stateful workloads. Since I’m just starting out and shutting down the cluster every day (to safe my power bill), I’ve noticed that Longhorn takes a long time to be ready, with a messy startup involving a lot of errors and pods going into the CrashLoopBackOff state.

Spoiler: It’s always DNS :)

Troubleshooting

I decided to take a look, so I began my troubleshooting journey by analyzing one of the affected pods.

From iptables to nftables with Docker

Fri, 20 Jun 2025 06:53:41 +0000

This blog post was initially intended to explain how to migrate from iptables to nftables — there are plenty of similar posts all over the internet. However, I soon realised that I was also running Docker on my laptop, which still does not natively support nftables at the time of writing. I therefore decided to write a dual-aim article: switching to nftables and allowing Docker containers to access the network.

Update - 2025-12-07: Docker 29 introduced experimental support for nftables, more details in the page Docker with nftables
Update - 2026-08-23: Optimized nftables rules for Docker 29

Home K3s Cluster: My Journey Into Self-Hosting & Automation

Sun, 01 Jun 2025 11:30:23 +0000

Why I Did It

At first, this was a learning project. I wanted to understand the real nuts and bolts of Kubernetes — not just on paper, but on actual, bare-metal hardware in my home.

But over time, it became something more. It became my platform — the place where I host the things I care about, where I experiment, where I break things and fix them again.

What I Wanted

To learn how things really work under the hood
To automate everything — no clicking, no guesswork
To host my own services with security and flexibility in mind
To power things down when I don’t need them, and boot them up instantly when I do

What I Built

The stack is simple but powerful:

Let’s Encrypt Certificates with SWAG Docker Swarm

Mon, 07 Oct 2024 19:26:02 +0000

Having worked out how to handle TLS traffic on my K3S setup, it is time to achieve the same goal on Docker. In this guide, I’ll show you how to set up a Raspberry Pi running Docker Swarm, SWAG (Secure Web Application Gateway), and Let’s Encrypt to secure your containerized applications with free TLS certificates. While I’ll use Jellyfin as an example, this approach works for most containerized applications.

Getting started

Prerequisites

A Raspberry Pi with Docker and Docker Swarm.
A public domain managed, for example, by Cloudflare.
Containerized applications, such as Jellyfin, running on Docker.
SWAG to handle reverse proxy and TLS certificates.

Folder structure

All my Docker containers data is stored on BTRFS volume under /opt/my_pool where I have created a folder for each container and the nas-stack.yml file with all the Docker instructions.

Let’s Encrypt certificates with Traefik

Sun, 01 Sep 2024 15:42:50 +0000

In this article, we’ll look at using Traefik in K3S alongside cert-manager to act as an ACME (Automatic Certificate Management Environment) client for acquiring certificates from Let’s Encrypt.

In order to obtain certificates, it is necessary to prove domain ownership to a Certificate Authority (CA). One method of verifying ownership is through a DNS-01 challenge.

For this guide, we will use Cloudflare as our DNS provider, but the principles outlined can easily be adapted for use with other DNS providers.

Mikrotik OpenTofu - Part #1

Sun, 04 Aug 2024 18:16:26 +0000

This is the first part of my MikroTik and OpenTofu series, where I will explain my old and current setup and answer a lot of questions about why.

Old setup

Many, many years ago I decided to abandon the traditional two-pair wiring hDSL (most widespread, at least in Switzerland) because I was bored of paying the electrician at each house change due to the required changes on the building telephone panel. To cut a long story short, I chose the LTE modem for its versatility, I have no need for high performance and therefore did not choose fibre optics.

Integrate Dnscrypt-proxy with a Home DNS Server

Wed, 31 Jul 2024 04:47:14 +0000

I recently bought a MikroTik router and I’m spending a lot of time configuring it and trying to understand/learn as much as I can (some posts coming in the near future). With the new router I would like to go a step further and set up some static DNS entries within my home for my devices and for my lab.

In this post we will:

Prevent dhcpd and NetworkManager to overwrite /etc/resolv.conf
Configure Dnscrypt-proxy to use Quad9 with DoH
Use Dnscrypt-proxy forwarding feature to resolve hostnames of home devices
Manually configure /etc/resolv.conf

Configure dhcpd

By default, dhcpd obtains nameservers from the DHCP server and configures them in /etc/resolv.conf. If you are a frequent traveller, this means that you will use whatever name servers are configured on the networks you connect to, with some potential security threads (MiTM, DNS Spoofing/Hijacking and privacy risks). To avoid this, we will configure dhcpd to ignore the DNS servers received from the dhcp server and always use Dnscrypt-proxy listening on localhost:53.

Embracing Man Pages

Thu, 11 Jul 2024 19:49:49 +0000

Nowadays, the browser is always open on my computer and I spend most of my time there. If there is a problem or I need to look up the parameters of a command, the first thing I do is look it up on the web. Now I want to go back to using man pages and rediscover the romance and essence that they convey.

Why Man Pages?

Always there when you need them: Unlike the internet, which requires connectivity, man pages are always right there on your system. Whether you’re on a plane, in a remote area, or just want to avoid the distractions of the web, man pages are a reliable companion.

Raspberry Btrfs

Wed, 10 Jul 2024 15:52:10 +0000

I would like to build a simple NAS using my Raspberry Pi 5, equipped with the Geekworm X1011 and an M.2 NVMe drives. This project will also provide me with the opportunity to use BTRFS for the first time.

Getting started

To install BTRFS excecute the following commnad:
```
sudo apt install btrfs-progs
```

Uses lsblk to get the current partitions status

$ lsblk 
NAME        MAJ:MIN RM   SIZE RO TYPE MOUNTPOINTS
mmcblk0     179:0    0  14.9G  0 disk 
├─mmcblk0p1 179:1    0   512M  0 part /boot/firmware
└─mmcblk0p2 179:2    0  14.4G  0 part /
nvme0n1     259:0    0 476.9G  0 disk 
└─nvme0n1p1 259:1    0 476.9G  0 part 
nvme1n1     259:2    0 238.5G  0 disk 
nvme2n1     259:7    0 238.5G  0 disk

If necessary, use one of the many tools, such as wipefs, fdisk, cfdisk, or parted, to remove the old partitions, for example:

Debian Preseed late_command

Mon, 01 Jul 2024 16:05:02 +0000

In Debian installation process, the preseed.cfg file allows for automated installations by pre-configuring various installation parameters. In this article I will focus on the d-i preseed/late_command string parameter, which is used to run custom commands at the end of the installation process.

Here is an example that I recently used in my packer-vbox-debian-latest project:

d-i preseed/late_command string \
mkdir --mode=700 /target/home/testuser/.ssh; \
wget -q http://10.0.2.2:8081/key.pub -O /target/home/testuser/.ssh/authorized_keys; \
in-target chown testuser:testuser /home/testuser/.ssh; \
in-target chown testuser:testuser /home/testuser/.ssh/authorized_keys; \
in-target chmod 0600 /home/testuser/.ssh/authorized_keys

As you can see, sometimes /target is used, other times in-target, I must admit I struggled a bit to understand the difference and when to use one instead of the other.

Install Arch with SSH

Sat, 22 Jun 2024 07:33:40 +0000

My current Arch Linux installation has many years and I’d like to reinstall it using other technologies like LVM and BTRFS, but before reinstalling my laptop, I’m testing the installation process inside a VirtualBox VM. This morning I got bored of typing all the commands and in my head popped up Powershell Direct with Hyper-V. Basically you can attach a Powershell session directly to the Hyper-V VM.

I found a similar approach by configuring port forwarding in VirtualBox and connecting via SSH.

NVM on Enterprise

Tue, 11 Jun 2024 19:44:00 +0000

Node Version Manager for Windows is the de facto tool for managing multiple versions of Node.js, and is widely used by developers. In organisations where high security standards are in place, it can be a challenge to allow developers to use NVM.

Getting started

The aim of this short guide is to enable your developers to use NVM for Windows without the need for administrator rights, applying the concept of least privilege.

Raspberry Pi Notes

Fri, 31 May 2024 10:27:03 +0000

These evolving personal notes document my journey and discoveries as I explore the versatile Raspberry Pi. At present, all information pertains specifically to the Raspberry Pi 5.

Power

Minimum required: 5V / 3A (can’t connect any bus-powered HDDs/SSDs)
Best performance: 5v / 5A

Remainder: x Volt * y Amp = z Watt

Pogo Pin: A pogo pin is a spring-loaded connector used to create reliable electrical connections in electronics without the need for soldering, commonly for programming and connecting peripherals.

Not in My Picture

Fri, 10 May 2024 11:39:18 +0000

Surely you have been in a situation where you wanted to wait before taking a photo because there were other people in the lens. Or think about how beautiful the photo of that square would have been without the people.

That’s it… I do this almost every time I take a photo (apart from the time I was in the middle of nowhere in Iceland). So I said to myself: either I get up at 5am and take the photo, hoping that nobody else has had my bright idea, or we try to remove the objects with AI.

How I Set Up This Site

Sat, 04 May 2024 09:23:32 +0000

While creating this blog, I thought why not write my first post documenting the steps I took to make it all happen? Maybe this could help other people who have decided to take the same journey as me, so let’s get started!

Update - 2026-08-23: Removed Gist shortcut

Past experiences

Actually this is my second blog, for several years I maintained a website called TuxLinux where I wrote about my first experiences in the Linux world, all using WordPress. But this time I was more determined to try something new (at least for me), so I started searching the internet for something like this: